Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

Summary: HashiCorp, Veeam, and the Django Software Foundation patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django, with fixes in Terraform MCP Server 1.1.0, Veeam Service Provider Console 9.3.0.35057, and Django 6.0.8 or 5.2.17. The most severe is CVE-2026-16498, a CVSS 10.0 cross-tenant credential-reuse bug in Terraform MCP Server's stateless HTTP mode, where the MCP library did not assign unique session identifiers and the server's credential cache relied on them to separate users.
Key Takeaway: The 10.0 affects stateless mode, which an operator must enable deliberately, while the 8.9 isolation flaw affects the stateful mode that is the default for a central deployment, so which bug is in reach depends on configuration rather than the higher score. None of the eleven CVEs appears in CISA's Known Exploited Vulnerabilities catalog as of August 5, 2026, and no public proof-of-concept has surfaced.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-14869 CVE-2026-16496 CVE-2026-16498 CVE-2026-32998 CVE-2026-58067 CVE-2026-58071
Related: ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026